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REMARKS 

This Application has been carefully reviewed in light of the Office Action mailed 
April 28, 2005. Claims 1-19 were pending in the Application. In the Office Action, Claims 
1-19 appear to be rejected. Claims 1-19 remain pending in the Application. Applicant 
respectfully requests reconsideration and favorable action in this case. 

In the Office Action, the following actions were taken or matters were raised: 

ri AIMS K AND 15 

In the Office Action Summary, the Examiner indicates that Claims 8 and 15 are 
allowed. However, in the remaining portions of the Office Action, the Examiner appears to 
indicate that Claims 8 and 15 are rejected under 35 U.S.C § 102(e) (Office Action, page 2). 
Applicant respectfully requests clarification from the Examiner as to the status of Claims 8 
and 15. 

KPFCIFIC A TTON OR.TFCTIONS 

The specification was objected to for informalities. The Examiner suggested that 
Applicant provides the serial numbers of all co-pending applications mentioned on pages 1 
and 2 of the disclosure. Applicant has amended pages 1 and 2 of the specification to include 
the serial numbers of the respective noted co-pending applications. Applicant respectfully 
requests that this objection be withdrawn. 

SFCTTON 107 REJECTIONS 

Claims 1, 5-9, 15 and 16 were rejected under 35 U.S.C. 102(e) as being anticipated by 
U.S. Patent No. 6,279,113 issued to Vaidya (hereinafter "Vaidya"). As discussed above, the 
Office Action Summary appears to indicate that Claims 8 and 15 are allowed. However, page 
2 of the Office Action appears to indicate that Claims 8 and 15 are rejected in view of Vaidya. 
Thus, Applicant presumes that the Examiner means to reject Claims 8 and 15 in view of 
Vaidya, and Applicant responds accordingly. Applicant respectfully traverses this rejection. 
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Of the rejected claims, Claims 1 and 9 are independent. Applicant respectfully 
submits that Vaidya does not disclose or even suggest each and every limitation of 
independent Claims 1 and 9. 

Applicant respectfully reminds the Examiner that the burden for proving anticipation 
under 35 U.S.C. § 102 is on the Examiner, and it is the Examiner who has to prove that a 
claim is not patentable. In rejecting independent Claim 1 (and remaining Claims 5-9, 15 and 
16), the Examiner has not provided sufficient reasoning or made any assertions as to why he 
believes that the portions of Vaidya referred to by the Examiner disclose particular limitations 
of Claim 1 . The Examiner merely provides a general recitation of column and line numbers 
of Vaidya, leaving Applicant guessing as to the Examiner's intended meaning. For example, 
with respect to Applicant's Claim 1 recitation of "monitoring, by a first layer of an intrusion 
prevention system, application data of applications running at on the node," "monitoring, by a 
second layer of the intrusion prevention system, transport layer data of the node" and 
"monitoring, by a third layer of the intrusion prevention system, network layer data of the 
node," the Examiner merely states "see Col 4 Line 29-31" (Office Action, page 2) without 
indicating which components of Vaidya the Examiner is relying on to purportedly teach, for 
example, "a first layer of an intrusion prevention system," "a second layer of the intrusion 
prevention system," or "a third layer of the intrusion prevention system" as recited by Claim 
1. Because the Office Action fails to provide any indication of which components of Vaidya 
are relied upon by the Examiner to purportedly teach the limitations of Claim 1, Applicant 
finds it difficult, if not impossible, to adequately address the Examiner's rejection. Applicant 
requests the Examiner to clearly indicate which components of Vaidya the Examiner is 
relying on to purportedly teach the limitations of Claim 1 so that Applicant may have a fair 
opportunity to address the Examiner's concerns. 

Regardless, Applicant submits that Vaidya does not disclose or even suggest each and 
every limitation of independent Claim 1. For example, independent Claim 1 recites 
"monitoring, by a first layer of an intrusion prevention system, application data of 
applications running at on the node," "monitoring, by a second layer of the intrusion 
prevention system , transport layer data of the node" and "monitoring, by a third layer of the 
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intrusion prevention system , network layer data of the node" (emphasis added). The portions 
of Vaidya referred to by the Examiner fail to disclose or even suggest at least these 
limitation(s) recited by independent Claim 1, and Applicant is unable to determine why the 
Examiner believes that the portions of Vaidya referred to by the Examiner purportedly teach 
at least these limitation(s). For example, column 4, lines 29-31, of Vaidya recite: 

An advantage of the present invention is that all seven layers of 
the OSI model are monitored and so an attack based in any of 
the layers can be detected. 

Applicant respectfully submits that monitoring "all seven layers of [an] OSI model" as recited 
by the portion of Vaidya indicated above is not the same as "an intrusion prevention system" 
having different layers (e.g., a first layer for monitoring application data, a second layer for 
monitoring transport layer data, and a third layer for monitoring network layer data as 
generally recited by independent Claim 1). The Examiner has not explicitly identified any 
disclosure in Vaidya identifying different layers of an intrusion prevention system for 
monitoring different layers and/or types of data of a node as generally recited by independent 
Claim 1. Applicant respectfully submits that such details are lacking in Vaidya, and the 
Office Action fails to explain why the Examiner believes that such details are present in 
Vaidya. Therefore, for at least this reason, Applicant respectfully submits that Vaidya does 
not anticipate Claim 1 . 

Independent Claim 9 recites "monitoring application layer data, by a first layer of an 
intrusion prevention system comprised of the instructions, of a node of a network," 
"monitoring transport layer data, by a second layer of the intrusion prevention system , of the 
node of the network" and "monitoring network layer data, by a third layer of an intrusion 
prevention system , of the node of the network" (emphasis added). At least for the reasons 
discussed above in connection with independent Claim 1, Applicant respectfully submits that 
Vaidya does not disclose or even suggest each and every limitation of independent Claim 9, 
nor has the Examiner explicitly identified such limitations in Vaidya. Accordingly, Applicant 
respectfully submits that Vaidya does not anticipate independent Claim 9. 
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Claims 5-8, 15 and 16 that depend respectively from Claims 1 and 9 are also not 
anticipated by Vaidya at least because they incorporate the limitations of respective Claims 
1 and 9 and, also, they add additional elements that further distinguish Vaidya. Therefore, 
Applicant respectfully requests that the rejection of Claims 5-8, 15 and 16 be withdrawn. 

SECTION 103 REJECTIONS 

Claims 2-4, 10-13 and 17-19 were rejected under 35 U.S.C. 103(a) as being 
unpatentable over Vaidya in view of U.S. Patent No. 6,851,061 issued to Holland III et al. 
(hereinafter "Holland"). Applicant respectfully traverses this rejection. 

Claims 2-4 and 10-13 depend respectively from Claims 1 and 9. At least for the 
reasons discussed above, Claims 1 and 9 are in condition for allowance. Therefore, Claims 2- 
4 and 10-13 that depend respectively therefrom are also in condition for allowance. 
Accordingly, Applicant respectfully requests that the rejection of Claims 2-4 and 10-13 be 
withdrawn. 

Of the remaining rejected claims, Claim 17 is independent. Applicant respectfully 
submits that neither Vaidya nor Holland, alone or in combination, discloses, teaches or 
suggests the limitations of independent Claim 17. For example, independent Claim 17 recites 
"an operating system comprising a network stank comprising a protocol driver, a media 

access control driver . . . and an intrusion prevention system transport service provider layer" 
(emphasis added). The Examiner appears to indicate that Vaidya does not disclose at least the 
above-referenced limitations of independent Claim 17 {"Vaidya discloses an [sic] processor, 
memory module . . . but does not disclose the use of drivers to monitor network layer, 
transport layer interface . . . (Office Action, page 5). However, the Examiner also appears 
to indicate that Holland discloses such limitations (Office Action, page 5). Applicant 
respectfully disagrees. Holland appears to disclose an internal protocol (IP) stack 33 for 
processing incoming data frames {Holland, column 4, lines 41-44, figure 2). Holland also 
appears to disclose, and the Examiner appears to refer to, a packet filter 37 of Holland used to 
collect all network traffic transiting through the NIC 31 of Holland, and an auditing system 
34 for monitoring system-level activities (Office Action, page 5, Holland, column 4, lines 41- 
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55, figure 2). However, neither the packet filter 37 or auditing system 34 of Holland appear 
to form any portion of "a network stack." Thus, Holland does not appear to disclose or even 
suggest " a network stark comprising a protocol driver , a media access control driver . . . and 
an intrusio n prevention system transport service provider layer" as recited by independent 
Claim 17 (emphasis added), nor does the Examiner appear to explicitly identify any such 
disclosure in Holland. Moreover, Vaidya does not remedy at least this deficiency of Holland. 
Accordingly, for at least this reason, Applicant respectfully submits that neither Vaidya nor 
Holland^ alone or in combination, discloses, teaches or suggests the limitations of 
independent Claim 17. Therefore, Applicant respectfully requests that the rejection of Claim 
17 be withdrawn. 

Claims 18 and 19 depend from independent Claim 17. At least for the reasons 
discussed above, Applicant respectfully submits that Claim 17 is in condition for allowance. 
Therefore, Claims 18 and 19 that depend therefrom are also in condition for allowance. 
Accordingly, Applicant respectfully requests that the rejection of Claims 18 and 19 be 
withdrawn. 



Page 12 



Application Serial No. 10/003,747 



PATENT 



CONCLUSION 



Applicant has made an earnest attempt to place this case in condition for immediate 
allowance. For the foregoing reasons and for other reasons clearly apparent, Applicant 
respectfully requests reconsideration and full allowance of all pending claims. 

No fee is believed due with this Response. If, however, Applicant has overlooked the 
need for any fee due with this Response, the Commissioner is hereby authorized to charge any 
fees or credit any overpayment associated with this Response to Deposit Account No. 08- 
2025 of Hewlett-Packard Company. 



Date: Tn ly 1 1 , 2 005 

Correspondence to: 

L. Joy Griebenow 

Hewlett-Packard Company 

Intellectual Property Administration 

P. O. Box 272400 

Fort Collins, CO 80527-2400 

Tel. 970-898-3884 



Respectfully submitted, 
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